Repository navigation
chore(deps): bump @hono/node-server to 2.1.6 in package-lock.json (2 advisories) #5545
Description
Filed automatically from 2 open Dependabot alerts by the daily alert sweep (#4874). The fix is written by hand against v2/main.
| Package | @hono/node-server (npm) |
| Manifest | package-lock.json |
Vulnerable on v2/main |
2.1.4 |
| Bump to | 2.1.6: the lowest listed patched version that no range below covers |
| Scope | runtime |
| Highest severity | medium |
Advisories
| GHSA | CVE | Severity | Vulnerable range | Fixed in | Summary |
|---|---|---|---|---|---|
| GHSA-jpvv-r467-5p4w | CVE-2026-126210 | medium | >= 2.0.0, < 2.1.6 | 2.1.6 | @hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy |
| GHSA-qv5m-9pm6-hqp3 | CVE-2026-126343 | medium | >= 2.0.0, < 2.1.6 | 2.1.6 | @hono/node-server: Unhandled ECONNRESET on the socket during an asynchronous WebSocket upgrade crashes the process |
Fix
Add an overrides entry in the root package.json pinning @hono/node-server to >=2.1.6, for the copies below, which no declared range reaches. Not npm audit fix, which can resolve an advisory by silently downgrading.
Then verify before opening the PR: every locked copy must be outside every range in the Advisories table. node scripts/dependabot-alerts.mjs --dry-run against the branch should report this exposure cleared.
| Vulnerable copy | Version |
|---|---|
node_modules/@hono/node-server |
2.1.4 |
Note
The GHSA, CVE, severity, range and summary are the advisory's own, as Dependabot reports them. What this sweep verified against v2/main is the installed versions and whether each advisory's range still matches them: GitHub computes alerts from the default branch, so an alert is filed only after that re-check.
Activity